Does Config Lock disable the "OK" button on changes?

[jwolach]

I thought a Config Lock is supposed to disable the "OK" button when making configuration changes.  Could someone please confirm that's the case?

[gswcowboy · Accepted solution]

Doesn't disable the OK but it does relay the block upon clicking said OK button.

Blocks other administrators from making changes to the configuration. This type of lock can be set globally or for a virtual system. It can be removed only by the administrator who set it or by a superuser on the system. 

[jwolach]

Thanks for the clarification.  One additional question, can a Superuser make changes even if there's a Config Lock taken by another user?  The reason for that question is because my PAN is allowing the SU to make changes to the config even though there's a Config Lock taken.

[gswcowboy]

On my test, I was attempting to make a config change with another 'superuser' account and was prompted with that message.

[jwolach]

What version PAN-OS are you using?

[gswcowboy]

sw-version: 4.1.8-h1

[jwolach]

Ok... something's very weird.  I am also running 4.1.8 and yes, I am getting the lock dialog box when I tried to create a new Address Object, just like you show in your screenshots.  However, if it allows me to create a new Administrator account under the Device -> Administrators menu. Hmmm!!!!  Can you try it and let me know if you get the same results?

[gswcowboy]

Admin (superuser) locks config. 'Renato' superuser logs in and attempts to create another superuser (testadmin) but failing to create it due to config lock.

renato                    10.10.10.1      Web 10/23 10:58:29     00:07:49s

admin                   172.16.20.24      CLI 10/20 09:54:38     74:49:47s

[2012/10/23 12:59:52]

<request cmd="set" cookie="2031488784055045" obj="/config/mgt-config/users/entry[@name='testadmin']" newonly="yes">

  <permissions>

  <role-based>

  <superuser>yes</superuser>

  </role-based>

  </permissions>

  <phash>$1$orjkikoe$J.X5P497nbJ5Uty9yNrtc0</phash>

</request>

<response status="error" code="13"><msg><line>Configuration is locked by admin</line></msg></response>

[jwolach]

Here's my scenario...

Admin (superuser) logs in using Firefox browser. Admin takes the Config Lock.

Mickey (superuser) logs in using IE browser. Mickey attempts to create another superuser (testadmin) and SUCCEEDS!  Mickey also attempts to create a new Address object and gets an error message due to the config lock.  Mickey also attempts to change the Application on a Security Policy and SUCCEEDS!

Don't understand why?

[mharding]

It's probably due to the Device/Network vs Object/Policy config.

The lock must only be honored when making changes to the object/policy side of the config. When you add a new user, you're modifying the device config.

It would be interesting to see the results if you added the object first, and then tried to create a new user.